Node.js process rewriting built JS/HTML web assets after a build step

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•2

Detects a sequence where a build or minify tool (such as node, npm, esbuild, webpack) runs, followed shortly by a Node.js process modifying built JavaScript or HTML assets on the same device, which can indicate supply chain tampering or malicious code injection into application build outputs.